harbor Configuring Harbor with HTTPS Access

首先，下載下傳fq (fanqiang) harbor-offline-installer-v1.2.0-rc5.tgz           

本文參考(https://github.com/vmware/harbor/blob/master/docs/configure_https.md )

create your own ca certificate:

generate a certificate signing request:

if you use fqdn like reg.yourdomain.com to connect your registry host, then you must use reg.yourdomain.com as cn (common name). otherwise, if you use ip address to connect your registry host, cn can be anything like your name and so on:

generate the certificate of your registry host:

if you're using ip, say 10.1.1.5 to connect your registry host, you may instead run the command below:

after obtaining the yourdomain.com.crt and yourdomain.com.key files, you can put them into directory such as<code>/root/cert/</code>:

next, edit the file make/harbor.cfg , update the hostname and the protocol, and update the attributes <code>ssl_cert</code> and<code>ssl_cert_key</code>:

generate configuration files for harbor:

finally, restart harbor:

after setting up https for harbor, you can verify it by the following steps:

open a browser and enter the address: https://10.1.1.50 . it should display the user interface of harbor.

you may get an intermediate certificate from a certificate issuer. in this case, you should merge the intermediate certificate with your own certificate to create a certificate bundle. you can achieve this by the below command:

[

自簽ca證書：

cd /etc/pki/ca

touch index.txt

echo 01 &gt; serial

openssl genrsa -out /etc/pki/ca/private/cakey.pem 2048

chmod 600 private/cakey.pem

openssl req -new -x509 -key /etc/pki/ca/private/cakey.pem -days 7300 -out /etc/pki/ca/cacert.pem

cd /etc/docker/certs.d/

 mkdir 10.1.1.50

cd 10.1.1.50/

cp /etc/pki/ca/cacert.pem ./

 cat /etc/pki/ca/cacert.pem &gt;&gt; /etc/pki/tls/certs/ca-bundle.crt

systemctl restart docker

docker-compose stop

docker-compose up -d

 docker-compose ps

]

用一個例子來示範會更加清晰